Assessing the EU-US Data Privacy Framework
Overview
The European Commission adopted the adequacy decision for the EU-US Data Privacy Framework (DPF) on 10 July 2023, based on Commission Implementing Decision (EU) 2023/1795. This adequacy decision enables transfers of personal data from the EU/EEA to US organisations that have self-certified to the DPF with the US Department of Commerce (DoC), without the need for additional transfer mechanisms such as SCCs or BCRs. The DPF replaced the invalidated Privacy Shield framework and was designed to address the concerns raised by the Court of Justice in Schrems II (Case C-311/18) through the introduction of Executive Order 14086 limiting US signals intelligence activities.
DPF Adequacy Decision — Key Elements
Legal Basis
- Commission Implementing Decision (EU) 2023/1795 of 10 July 2023 pursuant to GDPR Art. 45(3)
- US Executive Order 14086 (7 October 2022) — Enhancing Safeguards for United States Signals Intelligence Activities
- Attorney General Regulation (29 June 2023) establishing the Data Protection Review Court (DPRC)
- UK Extension: The UK-US Data Bridge (effective 12 October 2023) extends DPF protections for UK-to-US transfers
Scope of Adequacy
The DPF adequacy decision applies only to transfers to US organisations that:
- Have actively self-certified to the DPF with the Department of Commerce
- Are subject to the investigatory and enforcement powers of the Federal Trade Commission (FTC) or the Department of Transportation (DoT)
- Are listed on the DPF List maintained by the DoC at dataprivacyframework.gov
The adequacy decision does not cover transfers to:
- US government agencies
- US organisations that have not self-certified
- US organisations subject to regulators other than the FTC or DoT (e.g., banks regulated by the OCC, telecommunications carriers regulated by the FCC)
Self-Certification Process
Eligibility Requirements
- The organisation must be subject to the jurisdiction of the FTC (under Section 5 of the FTC Act) or the DoT (under 49 USC).
- The organisation must commit to comply with all DPF Principles.
- The organisation must publicly disclose its DPF-compliant privacy policy.
- The organisation must identify an independent recourse mechanism for handling complaints.
- The organisation must pay the annual certification fee to the DoC.
Certification Steps
| Step | Action | Timeline |
|---|---|---|
| 1 | Review DPF Principles and assess organisational readiness | 2-4 weeks |
| 2 | Develop or update privacy policy to comply with DPF Principles | 2-3 weeks |
| 3 | Select and engage an independent recourse mechanism (IRM) | 1-2 weeks |
| 4 | Designate a contact person responsible for DPF compliance | 1 week |
| 5 | Complete the self-certification application at dataprivacyframework.gov | 1 week |
| 6 | Submit required documentation and privacy policy URL | 1 week |
| 7 | Pay annual certification fee (scaled by revenue) | Upon submission |
| 8 | DoC review and listing on the DPF List | 2-4 weeks after submission |
| 9 | Annual re-certification before expiry date | 12 months after initial certification |
Annual Certification Fee Schedule (2025)
| Organisation Annual Revenue | Fee |
|---|---|
| Up to USD 5 million | USD 0 (fee waived for small organisations) |
| USD 5 million — USD 25 million | USD 575 |
| USD 25 million — USD 500 million | USD 1,150 |
| USD 500 million — USD 5 billion | USD 2,300 |
| Over USD 5 billion | USD 3,450 |
DPF Principles
1. Notice Principle
Self-certified organisations must inform individuals about:
- The types of personal data collected
- The purposes of processing
- The right to access and correct data
- The type or identity of third parties to whom data may be disclosed
- The choices and means offered for limiting use and disclosure
- The independent recourse mechanism available
- The organisation's liability in cases of onward transfer to third parties
2. Choice Principle
Organisations must offer individuals the opportunity to opt out when personal data is:
- Disclosed to a third party (other than an agent acting on the organisation's behalf)
- Used for a purpose materially different from the purpose for which it was originally collected or subsequently authorised
For sensitive data (health, racial/ethnic origin, political opinions, religious beliefs, trade union membership, sex life, criminal record), affirmative express consent (opt-in) is required before disclosure or use for a new purpose.
3. Accountability for Onward Transfer Principle
Transfers to third-party controllers require:
- A contract stipulating the third party provides the same level of protection as the DPF Principles
- The third party notifies the organisation if it can no longer meet this obligation
Transfers to agents (processors) require:
- A contract restricting processing to specified purposes
- The agent provides the same level of protection
- The agent notifies the organisation and takes reasonable steps to stop and remediate unauthorised processing
4. Security Principle
Organisations must take reasonable and appropriate measures to protect personal data from loss, misuse, unauthorised access, disclosure, alteration, and destruction, taking into account the risks involved in processing and the nature of the data.
5. Data Integrity and Purpose Limitation Principle
Personal data must be:
- Relevant for the purposes of processing
- Reliable for its intended use
- Accurate, complete, and current
- Not processed in a way incompatible with the purposes for which it was collected or subsequently authorised
6. Access Principle
Individuals have the right to:
- Obtain confirmation of whether the organisation processes their data
- Have the data communicated to them within a reasonable time
- Challenge the accuracy of the data and have it corrected, amended, or deleted
Access may be restricted only in limited circumstances (e.g., where providing access would violate others' rights, where the burden or expense of providing access is disproportionate, or where disclosure would violate legal obligations).
7. Recourse, Enforcement, and Liability Principle
Organisations must provide:
- An accessible, independent, and affordable dispute resolution mechanism
- Procedures for verifying compliance with the DPF commitments
- Remediation of problems arising from non-compliance
- Consequences for the organisation if it fails to comply (sanctions by the FTC/DoT)
Data Protection Review Court (DPRC)
Structure
- The DPRC was established by the Attorney General Regulation of 29 June 2023 pursuant to Executive Order 14086.
- The DPRC is a two-tier review mechanism:
- First tier: Civil Liberties Protection Officer (CLPO) at the Office of the Director of National Intelligence (ODNI) reviews complaints and issues binding determinations
- Second tier: Data Protection Review Court reviews CLPO determinations upon application by the complainant or the intelligence community element
Process for EU Data Subjects
- Data subjects submit complaints to their national data protection authority (SA).
- The SA transmits the complaint to the EDPB Secretariat.
- The EDPB Secretariat forwards the complaint to the US via the designated channel.
- The CLPO investigates and determines whether a covered violation occurred.
- If a violation is found, the CLPO directs appropriate remediation.
- The complainant or the intelligence community element may apply for DPRC review.
- The DPRC appoints a special advocate to represent the complainant's interests.
- The DPRC issues a final, binding determination.
- The outcome is communicated back through the same channel to the SA and the data subject.
Key Safeguards in Executive Order 14086
| Safeguard | Description |
|---|---|
| Necessity standard | US signals intelligence collection must be necessary to advance a validated intelligence priority |
| Proportionality standard | Collection must be proportionate, balancing intelligence need against privacy impact |
| Prohibited purposes | Collection may not be conducted for suppressing dissent, disadvantaging persons based on ethnicity/race/religion, restricting freedom of the press, or gaining commercial competitive advantage |
| Bulk collection limits | Bulk collection permitted only for specific, enumerated objectives (e.g., counter-espionage, counter-terrorism); must be as tailored as feasible |
| Data retention limits | Personal data collected through signals intelligence must be deleted when no longer needed for the validated intelligence purpose |
| Binding nature | EO 14086 creates binding obligations enforceable through the DPRC |
Annual European Commission Review
The adequacy decision requires periodic review by the European Commission in cooperation with the EDPB and the European Parliament:
- First review: Conducted in 2024, published October 2024 — Commission concluded the DPF continues to ensure an adequate level of protection
- Subsequent reviews: At least every four years
- Review elements: Compliance enforcement by the FTC/DoT, DPRC functioning, implementation of EO 14086, developments in US surveillance law, FISA Section 702 reauthorization status
- Power to suspend or repeal: The Commission may suspend or repeal the adequacy decision if the level of protection is no longer adequate
Verification Checklist for EU Data Exporters
Before relying on the DPF for a transfer, the EU data exporter must verify:
| Check | Method |
|---|---|
| Importer is listed on the DPF List | Search dataprivacyframework.gov |
| Certification is active (not expired or withdrawn) | Check status and expiry date on the DPF List |
| Certification covers the relevant data categories | Review the organisation's DPF scope on the List (HR data, non-HR data, or both) |
| Importer is subject to FTC or DoT jurisdiction | Confirm regulatory jurisdiction in the DPF listing |
| Importer's privacy policy references DPF compliance | Review the published privacy policy at the URL listed |
| IRM identified | Confirm the independent recourse mechanism listed on the DPF entry |
| Data transfer falls within the scope of the adequacy decision | Confirm the transfer is to a self-certified organisation and not to a non-certified entity |
Risk Considerations and Ongoing Monitoring
Legal Stability Risks
- FISA Section 702: Reauthorised through April 2026; future legislative changes could affect the DPF adequacy assessment
- Judicial challenges: Privacy advocacy groups (notably noyb) have indicated the possibility of challenging the DPF before the CJEU, similar to the Schrems I and Schrems II proceedings
- Political risk: A change in US administration could affect the continued implementation of EO 14086
Mitigation Strategies
- Dual mechanism approach: Maintain executed SCCs as a backup mechanism for US transfers alongside DPF reliance, enabling rapid switching if the adequacy decision is suspended or invalidated.
- Monitoring programme: Track EC review outcomes, CJEU case filings, and US legislative developments.
- Contractual safeguards: Include DPF-specific termination and data return clauses in contracts with US importers, triggered by adequacy decision invalidation.
- Transfer register documentation: Record DPF as the transfer mechanism with the importer's DPF List entry date and re-certification schedule.
